firewall: make wider netmask for MTS